Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am working on a client system which had a domain migration which seemed to have gone a bit wrong, about a year ago. However, in the event logs on a a member server, there are constant entries about a user (Administrator) that tries to login but fails (the domain of this account is on the old domain). I have recommended a colleague to use sysinternals etc to find the process using this account, but is there any definitive way to find what process is using this account?

Thanks Gurdeep

share|improve this question
    
In the failed event, you should have IP of client (if it's through the network) –  Mathieu Chateau Apr 4 '12 at 22:36
add comment

1 Answer 1

I can only think of several places to look on a server
- Scheduled task - Service config - An icon using RunAs (although I don't think you can save the credentials)

I wouldn't think it would be too hard to review these manually.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.